Related Articles

Its severity is rated "low," but patches are out for the second flaw in DNSSEC to be discovered in three months. DNS experts say some exploits are to be expected as the transition continues.

DNS Security Extensions is supposed to be the technology that helps to secure the
Domain Name System, or DNS , against attack. Yet DNSSEC servers aren't always infallible,
as a pair of vulnerabilities proved this week.

While it's critical to the operation of the Internet as a whole, DNS came under
intense scrutiny in 2008 after security researcher
Dan Kaminsky disclosed that it was at risk from a widespread vulnerability.
Developing a long-term solution to DNS security problems is what the creation of
DNSSEC is all about.

Yet, this week, researchers identified DNSSEC itself as being at risk from a
cache-poisoning attack.

Specifically, the widely deployed BIND DNS server's DNSSEC implementation was
identified as being at risk from a DNSSEC-validation vulnerability. The ISC (Internet
Systems Consortium), which is the lead group behind the development of BIND, has now
issued patches for the affected BIND servers.